sandwich/Ansible-Bootstrap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor(configuration): reduce LUKS runtime temporary facts

Browse Source
This commit is contained in:
Sandwich
2026-02-11 05:37:18 +01:00
parent 5326907ae9
commit 469d89641e
2 changed files with 71 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

145
roles/configuration/tasks/encryption.yml
View File

@@ -7,17 +7,12 @@
block: block:
- name: Set LUKS configuration facts - name: Set LUKS configuration facts
vars: vars:
configuration_luks_mapper_name_value: >- luks_tpm2_pcrs: >-
{{ partitioning_luks_mapper_name }}
configuration_luks_device_value: "{{ partitioning_luks_device }}"
configuration_luks_tpm2_pcrs_raw: >-
{{ partitioning_luks_tpm2_pcrs }}
configuration_luks_tpm2_pcrs_normalized: >-
{{ {{
( (
configuration_luks_tpm2_pcrs_raw partitioning_luks_tpm2_pcrs
if configuration_luks_tpm2_pcrs_raw is string if partitioning_luks_tpm2_pcrs is string
else (configuration_luks_tpm2_pcrs_raw | map('string') | join('+')) else (partitioning_luks_tpm2_pcrs | map('string') | join('+'))
) )
| string | string
| replace(',', '+') | replace(',', '+')
@@ -25,11 +20,10 @@
| regex_replace('^\\+|\\+$', '') | regex_replace('^\\+|\\+$', '')
}} }}
ansible.builtin.set_fact: ansible.builtin.set_fact:
configuration_luks_mapper_name: "{{ configuration_luks_mapper_name_value }}" configuration_luks_mapper_name: "{{ partitioning_luks_mapper_name }}"
configuration_luks_uuid: "{{ partitioning_luks_uuid | default('') }}" configuration_luks_uuid: "{{ partitioning_luks_uuid | default('') }}"
configuration_luks_device: "{{ configuration_luks_device_value }}" configuration_luks_device: "{{ partitioning_luks_device }}"
configuration_luks_options: >- configuration_luks_options: "{{ partitioning_luks_options }}"
{{ partitioning_luks_options }}
configuration_luks_auto_method: >- configuration_luks_auto_method: >-
{{ {{
(partitioning_luks_auto_decrypt | bool) (partitioning_luks_auto_decrypt | bool)
@@ -38,12 +32,9 @@
'manual' 'manual'
) )
}} }}
configuration_luks_tpm2_device: >- configuration_luks_tpm2_device: "{{ partitioning_luks_tpm2_device }}"
{{ partitioning_luks_tpm2_device }} configuration_luks_tpm2_pcrs: "{{ luks_tpm2_pcrs }}"
configuration_luks_tpm2_pcrs: "{{ configuration_luks_tpm2_pcrs_raw }}" configuration_luks_keyfile_path: "/etc/cryptsetup-keys.d/{{ partitioning_luks_mapper_name }}.key"
configuration_luks_tpm2_pcrs_normalized: "{{ configuration_luks_tpm2_pcrs_normalized }}"
configuration_luks_keyfile_path: >-
/etc/cryptsetup-keys.d/{{ configuration_luks_mapper_name_value }}.key
changed_when: false changed_when: false
- name: Validate LUKS UUID is available - name: Validate LUKS UUID is available
@@ -70,54 +61,52 @@
- name: Build LUKS parameters - name: Build LUKS parameters
vars: vars:
configuration_luks_keyfile_in_use_value: "{{ configuration_luks_auto_method == 'keyfile' }}" luks_keyfile_in_use: "{{ configuration_luks_auto_method == 'keyfile' }}"
configuration_luks_option_list_value: >- luks_option_list: >-
{{ {{
(configuration_luks_options | trim).split(',') (configuration_luks_options | trim).split(',')
if configuration_luks_options | trim | length > 0 if configuration_luks_options | trim | length > 0
else [] else []
}} }}
configuration_luks_tpm2_option_list_value: >- luks_tpm2_option_list: >-
{{ {{
(configuration_luks_auto_method == 'tpm2') (configuration_luks_auto_method == 'tpm2')
| ternary( | ternary(
['tpm2-device=' + configuration_luks_tpm2_device] ['tpm2-device=' + configuration_luks_tpm2_device]
+ (['tpm2-pcrs=' + configuration_luks_tpm2_pcrs_normalized] + (['tpm2-pcrs=' + configuration_luks_tpm2_pcrs]
if configuration_luks_tpm2_pcrs_normalized | length > 0 else []), if configuration_luks_tpm2_pcrs | length > 0 else []),
[] []
) )
}} }}
configuration_luks_crypttab_keyfile_value: >- luks_crypttab_keyfile: "{{ configuration_luks_keyfile_path if luks_keyfile_in_use else 'none' }}"
{{ configuration_luks_keyfile_path if configuration_luks_keyfile_in_use_value else 'none' }} luks_crypttab_options: >-
configuration_luks_crypttab_options_value: >-
{{ {{
(['luks'] + configuration_luks_option_list_value + configuration_luks_tpm2_option_list_value) (['luks'] + luks_option_list + luks_tpm2_option_list)
| join(',') | join(',')
}} }}
configuration_luks_rd_options_value: >- luks_rd_options: "{{ (luks_option_list + luks_tpm2_option_list) | join(',') }}"
{{ (configuration_luks_option_list_value + configuration_luks_tpm2_option_list_value) | join(',') }} luks_kernel_args: >-
configuration_luks_kernel_args_value: >-
{{ {{
( (
['rd.luks.name=' + configuration_luks_uuid + '=' + configuration_luks_mapper_name] ['rd.luks.name=' + configuration_luks_uuid + '=' + configuration_luks_mapper_name]
+ ( + (
['rd.luks.options=' + configuration_luks_uuid + '=' + configuration_luks_rd_options_value] ['rd.luks.options=' + configuration_luks_uuid + '=' + luks_rd_options]
if configuration_luks_rd_options_value | length > 0 else [] if luks_rd_options | length > 0 else []
) )
+ ( + (
['rd.luks.key=' + configuration_luks_uuid + '=' + configuration_luks_keyfile_path] ['rd.luks.key=' + configuration_luks_uuid + '=' + configuration_luks_keyfile_path]
if configuration_luks_keyfile_in_use_value else [] if luks_keyfile_in_use else []
) )
) | join(' ') ) | join(' ')
}} }}
ansible.builtin.set_fact: ansible.builtin.set_fact:
configuration_luks_keyfile_in_use: "{{ configuration_luks_keyfile_in_use_value }}" configuration_luks_keyfile_in_use: "{{ luks_keyfile_in_use }}"
configuration_luks_option_list: "{{ configuration_luks_option_list_value }}" configuration_luks_option_list: "{{ luks_option_list }}"
configuration_luks_tpm2_option_list: "{{ configuration_luks_tpm2_option_list_value }}" configuration_luks_tpm2_option_list: "{{ luks_tpm2_option_list }}"
configuration_luks_crypttab_keyfile: "{{ configuration_luks_crypttab_keyfile_value }}" configuration_luks_crypttab_keyfile: "{{ luks_crypttab_keyfile }}"
configuration_luks_crypttab_options: "{{ configuration_luks_crypttab_options_value }}" configuration_luks_crypttab_options: "{{ luks_crypttab_options }}"
configuration_luks_rd_options: "{{ configuration_luks_rd_options_value }}" configuration_luks_rd_options: "{{ luks_rd_options }}"
configuration_luks_kernel_args: "{{ configuration_luks_kernel_args_value }}" configuration_luks_kernel_args: "{{ luks_kernel_args }}"
- name: Remove LUKS keyfile if TPM2 auto-decrypt is active - name: Remove LUKS keyfile if TPM2 auto-decrypt is active
when: configuration_luks_auto_method == 'tpm2' when: configuration_luks_auto_method == 'tpm2'
@@ -164,7 +153,7 @@
- name: Build mkinitcpio FILES list - name: Build mkinitcpio FILES list
when: os | lower == 'archlinux' when: os | lower == 'archlinux'
vars: vars:
configuration_mkinitcpio_files_list_value: >- mkinitcpio_files_list: >-
{{ {{
( (
configuration_mkinitcpio_slurp.content | b64decode configuration_mkinitcpio_slurp.content | b64decode
@@ -174,13 +163,13 @@
| default('') | default('')
).split() ).split()
}} }}
configuration_mkinitcpio_files_list_new_value: >- mkinitcpio_files_list_new: >-
{{ {{
( (
(configuration_mkinitcpio_files_list_value + [configuration_luks_keyfile_path]) (mkinitcpio_files_list + [configuration_luks_keyfile_path])
if configuration_luks_keyfile_in_use if configuration_luks_keyfile_in_use
else ( else (
configuration_mkinitcpio_files_list_value mkinitcpio_files_list
| reject('equalto', configuration_luks_keyfile_path) | reject('equalto', configuration_luks_keyfile_path)
| list | list
) )
@@ -188,7 +177,7 @@
| unique | unique
}} }}
ansible.builtin.set_fact: ansible.builtin.set_fact:
configuration_mkinitcpio_files_list_new: "{{ configuration_mkinitcpio_files_list_new_value }}" configuration_mkinitcpio_files_list_new: "{{ mkinitcpio_files_list_new }}"
- name: Configure mkinitcpio FILES list - name: Configure mkinitcpio FILES list
when: os | lower == 'archlinux' when: os | lower == 'archlinux'
@@ -227,27 +216,27 @@
- name: Build kernel cmdline with LUKS args - name: Build kernel cmdline with LUKS args
when: is_rhel | bool when: is_rhel | bool
vars: vars:
configuration_kernel_cmdline_current_value: >- kernel_cmdline_current: >-
{{ configuration_kernel_cmdline_slurp.content | b64decode | trim }} {{ configuration_kernel_cmdline_slurp.content | b64decode | trim }}
configuration_kernel_cmdline_list_value: >- kernel_cmdline_list: >-
{{ {{
configuration_kernel_cmdline_current_value.split() kernel_cmdline_current.split()
if configuration_kernel_cmdline_current_value | length > 0 else [] if kernel_cmdline_current | length > 0 else []
}} }}
configuration_kernel_cmdline_filtered_value: >- kernel_cmdline_filtered: >-
{{ {{
configuration_kernel_cmdline_list_value kernel_cmdline_list
| reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=') | reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=')
| list | list
}} }}
configuration_kernel_cmdline_new_value: >- kernel_cmdline_new: >-
{{ {{
(configuration_kernel_cmdline_filtered_value + configuration_luks_kernel_args.split()) (kernel_cmdline_filtered + configuration_luks_kernel_args.split())
| unique | unique
| join(' ') | join(' ')
}} }}
ansible.builtin.set_fact: ansible.builtin.set_fact:
configuration_kernel_cmdline_new: "{{ configuration_kernel_cmdline_new_value }}" configuration_kernel_cmdline_new: "{{ kernel_cmdline_new }}"
changed_when: false changed_when: false
- name: Write kernel cmdline with LUKS args - name: Write kernel cmdline with LUKS args
@@ -286,66 +275,66 @@
- name: Build grub command lines with LUKS args - name: Build grub command lines with LUKS args
when: not is_rhel | bool when: not is_rhel | bool
vars: vars:
configuration_grub_content_value: "{{ configuration_grub_slurp.content | b64decode }}" grub_content: "{{ configuration_grub_slurp.content | b64decode }}"
configuration_grub_cmdline_linux_value: >- grub_cmdline_linux: >-
{{ {{
configuration_grub_content_value grub_content
| regex_findall('^GRUB_CMDLINE_LINUX=\"(.*)\"', multiline=True) | regex_findall('^GRUB_CMDLINE_LINUX=\"(.*)\"', multiline=True)
| default([]) | default([])
| first | first
| default('') | default('')
}} }}
configuration_grub_cmdline_default_value: >- grub_cmdline_default: >-
{{ {{
configuration_grub_content_value grub_content
| regex_findall('^GRUB_CMDLINE_LINUX_DEFAULT=\"(.*)\"', multiline=True) | regex_findall('^GRUB_CMDLINE_LINUX_DEFAULT=\"(.*)\"', multiline=True)
| default([]) | default([])
| first | first
| default('') | default('')
}} }}
configuration_grub_cmdline_linux_list_value: >- grub_cmdline_linux_list: >-
{{ {{
configuration_grub_cmdline_linux_value.split() grub_cmdline_linux.split()
if configuration_grub_cmdline_linux_value | length > 0 else [] if grub_cmdline_linux | length > 0 else []
}} }}
configuration_grub_cmdline_default_list_value: >- grub_cmdline_default_list: >-
{{ {{
configuration_grub_cmdline_default_value.split() grub_cmdline_default.split()
if configuration_grub_cmdline_default_value | length > 0 else [] if grub_cmdline_default | length > 0 else []
}} }}
configuration_luks_kernel_args_list_value: "{{ configuration_luks_kernel_args.split() }}" luks_kernel_args_list: "{{ configuration_luks_kernel_args.split() }}"
configuration_grub_cmdline_linux_new_value: >- grub_cmdline_linux_new: >-
{{ {{
( (
( (
configuration_grub_cmdline_linux_list_value grub_cmdline_linux_list
| reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=') | reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=')
| list | list
) )
+ configuration_luks_kernel_args_list_value + luks_kernel_args_list
) )
| unique | unique
| join(' ') | join(' ')
}} }}
configuration_grub_cmdline_default_new_value: >- grub_cmdline_default_new: >-
{{ {{
( (
( (
configuration_grub_cmdline_default_list_value grub_cmdline_default_list
| reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=') | reject('match', '^rd\\.luks\\.(name|options|key)=' ~ configuration_luks_uuid ~ '=')
| list | list
) )
+ configuration_luks_kernel_args_list_value + luks_kernel_args_list
) )
| unique | unique
| join(' ') | join(' ')
}} }}
ansible.builtin.set_fact: ansible.builtin.set_fact:
configuration_grub_content: "{{ configuration_grub_content_value }}" configuration_grub_content: "{{ grub_content }}"
configuration_grub_cmdline_linux: "{{ configuration_grub_cmdline_linux_value }}" configuration_grub_cmdline_linux: "{{ grub_cmdline_linux }}"
configuration_grub_cmdline_default: "{{ configuration_grub_cmdline_default_value }}" configuration_grub_cmdline_default: "{{ grub_cmdline_default }}"
configuration_grub_cmdline_linux_new: "{{ configuration_grub_cmdline_linux_new_value }}" configuration_grub_cmdline_linux_new: "{{ grub_cmdline_linux_new }}"
configuration_grub_cmdline_default_new: "{{ configuration_grub_cmdline_default_new_value }}" configuration_grub_cmdline_default_new: "{{ grub_cmdline_default_new }}"
- name: Update GRUB_CMDLINE_LINUX_DEFAULT for LUKS - name: Update GRUB_CMDLINE_LINUX_DEFAULT for LUKS
when: not is_rhel | bool when: not is_rhel | bool

8
roles/configuration/tasks/encryption/tpm2.yml
View File

@@ -31,8 +31,8 @@
| regex_replace('^/mnt', '') | regex_replace('^/mnt', '')
) )
] ]
+ (['--tpm2-pcrs=' + configuration_luks_tpm2_pcrs_normalized] + (['--tpm2-pcrs=' + configuration_luks_tpm2_pcrs]
if configuration_luks_tpm2_pcrs_normalized | length > 0 else []) if configuration_luks_tpm2_pcrs | length > 0 else [])
+ [configuration_luks_device] + [configuration_luks_device]
}} }}
configuration_luks_enroll_chroot_cmd: >- configuration_luks_enroll_chroot_cmd: >-
@@ -55,8 +55,8 @@
'--wipe-slot=tpm2', '--wipe-slot=tpm2',
'--unlock-key-file=' + configuration_luks_tpm2_passphrase_tempfile.path '--unlock-key-file=' + configuration_luks_tpm2_passphrase_tempfile.path
] ]
+ (['--tpm2-pcrs=' + configuration_luks_tpm2_pcrs_normalized] + (['--tpm2-pcrs=' + configuration_luks_tpm2_pcrs]
if configuration_luks_tpm2_pcrs_normalized | length > 0 else []) if configuration_luks_tpm2_pcrs | length > 0 else [])
+ [configuration_luks_device] + [configuration_luks_device]
}} }}
ansible.builtin.command: ansible.builtin.command: